Google Settles With FTC Over Google Buzz

By

Julia Angwin And

Amir Efrati

Updated March 31, 2011 12:01 a.m. ET

Google Inc. agreed to strict privacy rules and said it would ask users before sharing their data with outsiders in a proposed settlement of government claims that it violated users' privacy at its social network, Google Buzz.

Google agreed to settle an FTC complaint that it "violated its own privacy promises" with the launch of its social network, Google Buzz, which automatically shared information in Gmail address books. Plus: if you dream of super fast Internet, you may want to consider moving to Kansas City.

The proposed settlement with the Federal Trade Commission, announced Wednesday, requires the Web-search giant to develop a "comprehensive privacy program" and to submit to independent privacy audits every two years for the next 20 years.

The FTC said the settlement marked the first time a company had agreed to implement a wide-ranging privacy program that will cover future as well as current products. The agreement protects people's names and e-mail addresses, as well as information about their contacts, location and unique identifiers transmitted by their computer or cellphone. The settlement could serve as a model for curbs on other tech companies.

"We are sending a signal that we want companies to be accountable for their privacy policies," said Jessica Rich, deputy director of the FTC's Bureau of Consumer Protection.

In its complaint, the FTC alleged that Google used "deceptive tactics and violated its own privacy promises to consumers" when it launched Buzz last year. Google initially made some Buzz users' contacts, such as the address book, automatically visible to others, angering many users. Google later changed the settings so contacts were kept private by default.

The requirement under the settlement to seek user permission before changing how it shares data with outsiders, known as "opt in," is unusually strict. It could hamper, at least temporarily, Google's ability to compete with rivals such as Facebook Inc. and Apple Inc.,AAPL-0.87% which don't need to seek user permission.

"Facebook gets to continue to do opt-out and Google has to do opt-in," said Christopher Soghoian, a privacy researcher who briefly worked for the FTC.

In a blog post, Alma Whitten, Google's director of privacy, said the privacy misstep with the launch of Google Buzz "fell short of our usual standards for transparency and user control." She said Google is "100% focused on ensuring that our new privacy procedures effectively protect the interests of all our users" going forward.

Google's privacy policy had said it would ask users for permission to use personal information "in a manner different than the purpose for which it was collected." Google later removed that language from its privacy policy, according to the FTC complaint. The settlement would effectively impose that policy for data shared outside of Google. It doesn't apply to data Google shares within the company.

ENLARGE

Alma Whitten, shown at a Senate hearing in July, said in a blog post that the privacy misstep with Google Buzz 'fell short' of Google's standards.
Getty Images

The FTC also charged Google with violating the terms of a privacy trade agreement with the European Union, which governs the transfer of personal data from the EU to the U.S. The FTC said it was the first time it had alleged substantive violations of the pact.

The FTC has become more aggressive in protecting online privacy. In December, the agency called for technology and advertising companies to develop a "do-not-track" mechanism that would allow Internet users to opt out of online tracking.

At a Senate hearing earlier this month, FTC Chairman Jon Leibowitz said that The Wall Street Journal's "What They Know" series on online privacy prompted the agency to "step up our enforcement efforts."

Sen. John Kerry (D., Mass.) said that the Google settlement underscores the need for a federal privacy law that would make all companies adhere to similar standards. "Every company should adhere to this kind of standard, not just Google," he said. Google has publicly stated its support for a comprehensive privacy law.

This copy is for your personal, non-commercial use only. Distribution and use of this material are governed by our Subscriber Agreement and by copyright law. For non-personal use or to order multiple copies, please contact Dow Jones Reprints at 1-800-843-0008 or visit www.djreprints.com.